CVE-2026-88765

This flaw can let a logged-in person turn a specially prepared project backup into control of the GitLab server. It is like allowing someone to deliver a filing box that, when opened by your records system, gives them access to the whole office.

This matters to you if your business runs GitLab EE and allows users to import Git project exports. It is only a risk when an attacker already has a GitLab login and can get a specially crafted export imported.

No confirmed attacks or public exploit code are on record, but a logged-in attacker could take over the server through a malicious project import. Treat this as an amber-priority fix: schedule the supported update promptly and limit import access until it is complete.

Confirm the installed GitLab edition and version, then review whether authenticated users can import Git project exports and whether Advanced Search indexing is enabled for those imports. Upgrade the relevant maintenance branch to 19.1.8, 19.2.6, or 19.3.2, or move to a later supported release; test the upgrade in a staging environment first because version upgrades can include operational or compatibility changes. If patching is delayed, limit GitLab access to trusted users and prevent imports of untrusted project exports. There is no CISA KEV due date because this CVE is not listed in KEV. Review GitLab audit and application logs for unexpected project-export imports and investigate unfamiliar account activity around imported projects.

CVE-2026-88765 is rated CVSS 8.5 (High): CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. It is CWE-77, though the technical description identifies the trigger as a specially crafted Git project export causing a Unicode conversion buffer overflow during Advanced Search indexing, enabling authenticated RCE under certain conditions. CISA KEV does not list this CVE, and no public exploit code is on record. EPSS is 0.7% (53rd percentile) with a flat trend; this is a prediction, not evidence of exploitation.